High 7.5Published Feb 14, 2026

CVE-2026-23139netfilter: nf_conncount: update last_gc only when GC has been performed

Updated under an hour ago (Oct 28, 2026, 7:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely. Update the last_gc value only when a GC has been actually performed.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f106694733c66a48740c25bc4e212e9b2ea364ce before 2c7c71113ed6d3e2f3aca4c088f22283016ff34f; from be69850b461e7b491d87a22e33ab76fdd04b725e before c4cde57c8affdcca5bcff53a1047e15d268bdca1; from d265929930e2ffafc744c0ae05fb70acd53be1ee before 9f45588993d7f115280fc726119ca86fba32a811; from d265929930e2ffafc744c0ae05fb70acd53be1ee before 3cd717359e56f82f06cbf8279b47a7d79880c6f3; from d265929930e2ffafc744c0ae05fb70acd53be1ee before 26a82dce2beee39c43c109d9647e16f49cb02a35; from d265929930e2ffafc744c0ae05fb70acd53be1ee before 8bdafdf4900040a81422056cabe5e00a37bd101a; from d265929930e2ffafc744c0ae05fb70acd53be1ee before 7811ba452402d58628e68faedf38745b3d485e3c	CNA record
linux linux_kernel linux:linux_kernel	from 5.19 before 6.1.161; from 6.2 before 6.6.121; from 6.7 before 6.12.66; from 6.13 before 6.18.6; 6.19; 6.19; 6.19; 6.19	NVD

References

References

https://git.kernel.org/stable/c/2c7c71113ed6d3e2f3aca4c088f22283016ff34f	patch
https://git.kernel.org/stable/c/c4cde57c8affdcca5bcff53a1047e15d268bdca1	patch
https://git.kernel.org/stable/c/9f45588993d7f115280fc726119ca86fba32a811	patch
https://git.kernel.org/stable/c/3cd717359e56f82f06cbf8279b47a7d79880c6f3	patch
https://git.kernel.org/stable/c/26a82dce2beee39c43c109d9647e16f49cb02a35	patch
https://git.kernel.org/stable/c/8bdafdf4900040a81422056cabe5e00a37bd101a	patch
https://git.kernel.org/stable/c/7811ba452402d58628e68faedf38745b3d485e3c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.